{"id":"CVE-2026-42712","published":"2026-10-10T20:16:36.397","lastModified":"2026-10-13T13:28:15.717","description":"Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/qode-tours/vulnerability/wordpress-qode-tours-plugin-3-1-3-2-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A SQL injection vulnerability in Qode Tours plugin versions 3.1.3.2 and earlier allows authenticated attackers to execute arbitrary SQL commands against the application's database. This could lead to unauthorized data access, modification, or deletion.","exploitability":"Exploitation requires an authenticated user account with subscriber-level privileges, making it moderately difficult but not highly complex to achieve.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive customer data, modify tour bookings, and potentially escalate privileges within the WordPress site.","remediation":"Upgrade to Qode Tours version 3.1.3.3 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","authenticated","database"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:07:03.562Z"}}